4.18 Cisco IBNS 2.0 (C3PL) for Authentication, Access Control, and User Policy Enforcement CCIE-SECURITY Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is implementing IBNS 2.0 to enforce different access policies for employees and contractors on the same wired switch. The RADIUS server (Cisco ISE) returns a downloadable ACL (dACL) for contractors that restricts access to a specific server subnet. The switch must apply this dACL only to contractor sessions. In the C3PL policy map, where should the dACL be referenced to ensure it is applied after successful authentication?

   • AIn the policy map as an action under the authentication class
   • BIn the class map that matches the contractor user group
   • CIn the parameter map for the RADIUS server
   • DIn the interface configuration using a static ACL
   Reveal Solution Discussion Select an answer first
2. 42expert · hard · select all that apply

   A network architect is explaining IBNS 2.0 to a colleague. Which of the following are true about IBNS 2.0 architecture? (Select all that apply.)

   • AIt requires a separate policy server for each switch
   • BIt uses C3PL for policy definition
   • CIt only works with Cisco switches
   • DIt can enforce authorization based on user identity
   • EIt supports multiple authentication methods
   Check answers Discussion Select an answer first
4. 43application · medium

   A hospital uses IBNS 2.0 with Cisco ISE to enforce compliance for staff laptops. The security policy requires that if a laptop fails posture assessment, it must be placed in a quarantine VLAN and reauthenticated every 10 minutes until it becomes compliant. The network engineer is configuring the C3PL policy map. Which action should be configured to enforce the 10-minute reauthentication for non-compliant sessions?

   • AUse a parameter map to set the authentication timer to 600 seconds
   • BApply a downloadable ACL that blocks all traffic
   • CConfigure the RADIUS server to send Access-Accept with VLAN 99
   • DSet the session-timeout to 600 seconds
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A network admin is troubleshooting an IBNS 2.0 deployment where 802.1X authentication is failing for all users. The switch logs show 'RADIUS server not responding' and the RADIUS server is reachable via ping. The switch is configured with a RADIUS server group. What is the most likely cause of the authentication failure?

   • AThe VLAN is not configured on the switch
   • BThe client is not sending an EAPOL start
   • CThe RADIUS shared secret is incorrect
   • DThe switch is not configured with aaa new-model
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A service provider is designing a new IBNS 2.0 solution for a multi-tenant building. Each tenant must have its own authentication policy and VLAN assignment. The design must use a single switch and a single RADIUS server. Which IBNS 2.0 component is essential to differentiate policies per tenant?

   • AA parameter map for each tenant
   • BA single global policy map applied to all interfaces
   • CA separate VLAN for each tenant but no policy differentiation
   • DC3PL class maps that match on tenant-specific attributes
   Reveal Solution Discussion Select an answer first